Data protection
Privacy & data protection
Who is responsible
The data controller is Craftmark, Austria. For privacy questions or to exercise your rights, contact privacy@craftmark.eu. No data protection officer has been appointed for the current pilot.
What we collect and why
- Account data (email, name, role, password hash) — to create and secure your account. Legal basis: performance of a contract / legitimate interest.
- Maker & product records you publish (company details, product passports, claims, evidence metadata) — to operate the platform.
- Buyer & order data (quote requests, custom order details, deposit records) — to provide the buyer-protection features. Buyer identity is shared with a maker only with your explicit consent.
- Limited usage signals — a hashed user-agent, a hashed anonymous session, country code, and referrer for QR scans, public views, and aggregate Simple Analytics traffic reporting. We do not store your IP address and we do not use advertising trackers or account-level analytics.
Cookies
We use only strictly-necessary and functional cookies: a session cookie, a security (CSRF) token, and a language-preference cookie. We do not set advertising or analytics cookies; Simple Analytics is used without cookies for aggregate public-page traffic reporting.
Where data is processed
Craftmark is hosted for European processing. Most static assets (styles and scripts) are served from Craftmark's own servers. The Simple Analytics script and collection endpoint are loaded from Simple Analytics for aggregate public-page traffic reporting. Map tiles are loaded from OpenStreetMap when you open the maker map.
How long we keep it
Account and order records are kept for as long as your account is active and as required for contractual and legal purposes. Usage signals are retained for a limited period and then deleted automatically. Order evidence snapshots are kept as immutable transaction evidence.
Your rights
You have the right to access, rectify, export, and erase your personal data, and to object to or restrict processing. From your profile you can:
- review and update your account details (access & rectification);
- download a copy of your data (portability);
- delete your account (erasure — evidence snapshots are retained where legally required, with your identity removed elsewhere).
You may also lodge a complaint with your national data protection authority.
